Adam Barth
John C. Mitchell
ABSTRACT
Cross-Site Request Forgery (CSRF) is a widely exploited web site vulnerability. In this paper, we present a new variation on CSRF attacks, login CSRF, in which the attacker forges a cross-site request to the login form, logging the victim into the honest web site as the attacker. The severity of a login CSRF vulnerability varies by site, but it can be as severe as a cross-site scripting vulnerability. We detail three major CSRF defense techniques and find shortcomings with each technique. Although the HTTP Referer header could provide an effective defense, our experimental observation of 283,945 advertisement impressions indicates that the header is widely blocked at the network layer due to privacy concerns. Our observations do suggest, however, that the header can be used today as a reliable CSRF defense over HTTPS, making it particularly well-suited for defending against login CSRF. For the long term, we propose that browsers implement the Origin header, which provides the security benefits of the Referer header while responding to privacy concerns.
- David Airey. Google's Gmail security failure leaves my business sabotaged, December 2007. http://www.davidairey.co.uk/google-gmail-security-hijack/.Google Scholar
- Robert Auger. The cross-site request forgery (CSRF/XSRF) FAQ, 2007. http://www.cgisecurity.com/articles/csrf-faq.shtml.Google Scholar
- Michael Barbaro and Tom Zeller Jr. A face is exposed for AOL searcher no. 4417749. The New York Times, August 2006. http://www.nytimes.com/2006/08/09/technology/09aol.htm.Google Scholar
- Adam Barth, Collin Jackson, and John C. Mitchell. Securing frame communication in browsers. In In Proceedings of the 17th USENIX Security Symposium (USENIX Security 2008), July 2008. Google ScholarDigital Library
- Tim Berners-Lee, Roy Fielding, and Henrik Frystyk. Hypertext Transfer Protocol--HTTP/1.0. RFC 1945, May 1996. Google ScholarDigital Library
- Douglas Crockford. JSONRequest, 2006. http://json.org/JSONRequest.html.Google Scholar
- Neil Daswani, Christoph Kern, and Anita Kesavan. Foundations of Security: What Every Programmer Needs to Know. Apress, 2007. Google ScholarDigital Library
- Rogan Dawes. Session Fixation, 2008. http://www.owasp.org/index.php/Session_Fixation_Protection.Google Scholar
- Rohit Dhamankar et al. Sans top-20 security risks, 2007. http://www.sans.org/top20/2007/.Google Scholar
- Rachna Dhamija, J. D. Tygar, and Marti Hearst. Why phishing works. In Proceedings of the Conference on Human Factors in Computing Systems (CHI), 2006. Google ScholarDigital Library
- E. W. Felten, D. Balfanz, D. Dean, and D. S. Wallach. Web Spoofing: An Internet Con Game. In 20th National Information Systems Security Conference, October 1997.Google Scholar
- Brad Fitzpatrick, David Recordon, Dick Hardt, Johnny Bufu, Josh Hoyt, et al. OpenID authentication 2.0, December 2007. http://openid.net/specs/openid-authentication-2_0.html.Google Scholar
- Seth Fogie, Jeremiah Grossman, Robert Hansen, Anton Rager, and Petko D. Petkov. XSS Attacks: Cross Site Scripting Exploits and Defense. Syngress, 2007. Google ScholarDigital Library
- Mozilla Foundation. Security advisory 2005-58, September 2005. http://www.mozilla.org/security/announce/2005/mfsa2005-58.html.Google Scholar
- Google. Security for GWT Applications. http://groups.google.com/group/Google-Web-Toolkit/web/security-for-gwt-applications.Google Scholar
- Robert Hansen and Tom Stracener. Xploiting Google gadgets: Gmalware and beyond, August 2008. Black Hat briefing.Google Scholar
- Elliotte Rusty Harold. Privacy tip #3: Block Referer headers in Firefox, October 2006. http://cafe.elharo.com/privacy/privacy-tip-3-block-referer-headers-in-firefox/.Google Scholar
- Mario Heiderich. CSRFx, 2007. http://php-ids.org/category/csrfx/.Google Scholar
- Ian Hickson et al. Cross-document messaging. http://www.w3.org/html/wg/html5/#crossDocumentMessages.Google Scholar
- Ian Hickson et al. HTML 5 Working Draft. http://www.whatwg.org/specs/web-apps/current-work/.Google Scholar
- Dan Holevoet. Changes to inline gadgets, August 2008. http://igoogledeveloper.blogspot.com/2008/08/changes-to-inlined-gadgets.html.Google Scholar
- Collin Jackson. Defeating frame busting techniques, 2005. http://crypto.stanford.edu/framebust/.Google Scholar
- Collin Jackson and Adam Barth. ForceHTTPS: Protecting high-security web sites from network attacks. In Proceedings of the 17th International World Wide Web Conference (WWW), April 2008. Google ScholarDigital Library
- Collin Jackson, Adam Barth, Andrew Bortz, Weidong Shao, and Dan Boneh. Protecting browsers from DNS rebinding attacks. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS 2007), November 2007. Google ScholarDigital Library
- Collin Jackson, Andrew Bortz, Dan Boneh, and John C. Mitchell. Protecting browser state from web privacy attacks. In Proceedings of the 15th International World Wide Web Conference (WWW), May 2006. Google ScholarDigital Library
- Martin Johns and Justus Winter. RequestRodeo: Client side protection against session riding. In Proceedings of the OWASP Europe 2006 Conference, May 2006.Google Scholar
- Aaron Johnson. The Referer header, intranets and privacy, February 2007. http://cephas.net/blog/2007/02/06/the-referer-header-intranets-and-privacy/.Google Scholar
- Paul Johnston and Richard Moore. Multiple browser cookie injection vulnerabilities, September 2004. http://www.westpoint.ltd.uk/advisories/wp-04-0001.txt.Google Scholar
- Nenad Jovanovic, Engin Kirda, and Christopher Kruegel. Preventing cross site request forgery attacks. In IEEE International Conference on Security and Privacy in Communication Networks (SecureComm), 2006.Google ScholarCross Ref
- Chris Karlof, Umesh Shankar, J. D. Tygar, and David Wagner. Dynamic pharming attacks and locked same-origin policies for web browsers. In Proceedings of the 14th ACM Conference on Computer and Communications Security (CCS 2007), November 2007. Google ScholarDigital Library
- Amit Klein. Exploiting the XMLHttpRequest object in IE--Referrer spoofing and a lot morełdots, September 2005. http://www.cgisecurity.com/lib/XmlHTTPRequest.shtml.Google Scholar
- Peter-Paul Koch. Frame busting. http://www.quirksmode.org/js/framebust.html.Google Scholar
- David Kristol and Lou Montulli. HTTP State Management Mechanism. RFC 2965, October 2000. Google ScholarDigital Library
- David Kristol and Lou Montulli. HTTP State Management Mechanism. RFC 2109, February 1997. Google ScholarDigital Library
- V. T. Lam, Spiros Antonatos, P. Akritidis, and Kostas G. Anagnostakis. Puppetnets: Misusing web browsers as a distributed attack infrastructure. In Proceedings of the 13th ACM Conference on Computer and Communication Security (CCS), October 2006. Google ScholarDigital Library
- PHP Manual. Session handling functions. http://www.phpbuilder.com/manual/en/ref.session.php.Google Scholar
- Chris Masone, Kwang-Hyun Baek, and Sean Smith. WSKE: Web server key enabled cookies. In Proceedings of Usable Security 2007 (USEC '07). Google ScholarDigital Library
- Microsoft. XDomainRequest object. http://msdn2.microsoft.com/en-us/library/cc288060(VS.85).aspx.Google Scholar
- Netscape. Persistent client state: HTTP cookies. http://wp.netscape.com/newsref/std/cookie_spec.html.Google Scholar
- Greg Pass, Abdur Chowdhury, and Cayley Torgeson. A picture of search. In InfoScale '06: Proceedings of the 1st International Conference on Scalable Information Systems, 2006. Google ScholarDigital Library
- Petko D. Petkov. Google Gmail e-mail hijack technique, September 2007. http://www.gnucitizen.org/blog/google-gmail-e-mail-hijack-technique/.Google Scholar
- Yngve Pettersen. HTTP state management mechanism v2. IETF Internet Draft, February 2008. http://www.ietf.org/internet-drafts/draft-pettersen-cookie-v2-02.txt.Google Scholar
- phpBB. http://phpbb.com/.Google Scholar
- Prototype JavaScript framework. http://www.prototypejs.org/.Google Scholar
- Ruby on rails. http://www.rubyonrails.org/.Google Scholar
- Secunia. Microsoft Internet Explorer "XMLHTTP" HTTP request injection, September 2005. http://secunia.com/advisories/16942/.Google Scholar
- Eric Sheridan. OWASP CSRFGuard Project, 2008. http://www.owasp.org/index.php/CSRF_Guard.Google Scholar
- Trac. http://trac.edgewall.org/.Google Scholar
- Anne van Kesteren et al. Access control for cross-site requests. http://www.w3.org/TR/access-control/.Google Scholar
- Luis von Ahn, Nick Hopper Manuel Blum, and John Langford. CAPTCHA: Using hard AI problems for security. In Eurocrypt 2003. Google ScholarDigital Library
- Weilin Zhong. Session Fixation, 2008. http://www.owasp.org/index.php/Session_Fixation.Google Scholar
Index Terms
-
Robust defenses for cross-site request forgery
-
Recommendations
-
Browser protection against cross-site request forgery
SecuCode '09: Proceedings of the first ACM workshop on Secure execution of untrusted codeAs businesses are opening up to the web, securing their web applications becomes paramount. Nevertheless, the number of web application attacks is constantly increasing. Cross-Site Request Forgery (CSRF) is one of the more serious threats to web ...
-
Defeating Cross-Site Request Forgery Attacks with Browser-Enforced Authenticity Protection
Financial Cryptography and Data SecurityA cross site request forgery (CSRF) attack occurs when a user's web browser is instructed by a malicious webpage to send a request to a vulnerable web site, resulting in the vulnerable web site performing actions not intended by the user. CSRF ...
-
Study of Cross-Site Request Forgery on Web-Based Application: Exploitations and Preventions
AbstractCross-Site Request Forgery (CSRF) is a prominent web exploit that continues to pose significant security risks, even on highly ranked websites. This research focuses on identifying the underlying vulnerability, understanding the techniques ...
Reviews
Zheng Gong
Cross-site attacks are widely used to exploit Web site vulnerability. Barth, Jackson, and Mitchell present in this paper a detailed description of cross-site request forgery (CSRF), a specific kind of cross-site attack. CSRF allows the attacker to forge a valid request to a Web site by redirecting the user. The authors also discuss the existing defenses against CSRF and suggest "modifying browsers to send an origin header with POST requests that identifies the [source] that initiated the request." The paper is well written and the references are up to date. The paper should be valuable to professionals in the Internet security area. Online Computing Reviews Service
Access critical reviews of Computing literature here
Become a reviewer for Computing Reviews.
Comments